code wiki / _hdl_build / nx_security_audit.nx
nx_security_audit.nx source
↩ module page · 78 lines · 5730 B
1// nx_security_audit.nx -- the AUDITOR grades the security stack on the maturity ladder (ABSENT..
2// EXCEED), EVIDENCE-GATED: each capability's `exists` flag comes from RUNNING its real gate (fork/
3// exec, exit 0 = exists), never assertion. The hardened/parity/beats flags are the honest standing
4// assessment encoded as data (Rule #11). This is the AUDITOR role's first DURABLE output (the role
5// scorecard showed it NO-EVIDENCE). HONEST by construction: parity_vs_best=0 everywhere because the
6// crypto is NOT yet triangulated against a best-in-class reference (openssl/libsodium KAT vectors) ->
7// the ceiling here is PRODUCTION, never S-CLASS/EXCEED. Writes MATAUDIT lines to
8// knowledge/status/maturity_audit.log. license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_maturity_auditor.nx"
11func _p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func _pn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
13func _fp(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 }
14func _fn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48;k=1}; while m>0{t[k]=48+(m%10);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 }
15// run a gate ELF, muted; exit 0 => exists-evidence = 1
16func sa_exists(path: *u8) -> i64 {
17 let pid: i64 = sys_fork()
18 if pid == 0 {
19 let argv: *i64 = sys_mmap(16) as *i64; argv[0] = path as i64; argv[1] = 0
20 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
21 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4); if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) }
22 sys_execve(path, argv, envp)
23 sys_exit(127)
24 }
25 let st: *i64 = sys_mmap(16) as *i64
26 sys_wait4(pid, st, 0)
27 if ((st[0] >> 8) & 0xff) == 0 { return 1 }
28 return 0
29}
30// grade one capability + emit. exists from the gate; the rest = honest standing flags.
31func sa_grade(lfd: i64, name: *u8, exists: i64, real: i64, hard: i64, parity: i64, beats: i64, gap_note: *u8, acc: *i64) -> i64 {
32 let lvl: i64 = mat_level(exists, real, hard, parity, beats)
33 _p(" " as *u8); _p(name); _p(" = " as *u8); _p(mat_label(lvl))
34 _p(" (-> next: " as *u8); _p(gap_note); _p(")\n" as *u8)
35 _fp(lfd, "MATAUDIT cap=" as *u8); _fp(lfd, name)
36 _fp(lfd, " level=" as *u8); _fn(lfd, lvl)
37 _fp(lfd, " label=" as *u8); _fp(lfd, mat_label(lvl))
38 _fp(lfd, " gap_to_sclass=" as *u8); _fn(lfd, mat_gap_to_sclass(lvl))
39 _fp(lfd, "\n" as *u8)
40 if lvl > acc[0] { acc[0] = lvl }
41 if lvl < acc[1] { acc[1] = lvl }
42 return lvl
43}
44func main() -> i64 {
45 _p("=== SECURITY MATURITY AUDIT (Auditor role; evidence-gated; honest ceiling = PRODUCTION) ===\n" as *u8)
46 let lfd: i64 = sys_openat_append("knowledge/status/maturity_audit.log" as *u8, 0x1a4)
47 if lfd < 0 { _p(" audit log open failed\n" as *u8); sys_exit(1); return 1 }
48 _fp(lfd, "MATAUDIT-RUN epoch=" as *u8); _fn(lfd, sys_now_realtime_sec()); _fp(lfd, " domain=security\n" as *u8)
49 let acc: *i64 = sys_mmap(16) as *i64
50 acc[0] = 0 // max level seen
51 acc[1] = 99 // min level seen
52 // exists-evidence from the REAL gates
53 let e_vault: i64 = sa_exists("/tmp/nx_vault_selftest.sov.elf" as *u8)
54 let e_multi: i64 = sa_exists("/tmp/nx_vault_multi.sov.elf" as *u8)
55 let e_audit: i64 = sa_exists("/tmp/nx_audit_gate.sov.elf" as *u8)
56 // vault encryption: real AES-GCM, hardened (fail-closed), NOT triangulated vs openssl -> PRODUCTION
57 sa_grade(lfd, "vault-encryption-at-rest" as *u8, e_vault, 1, 1, 0, 0, "triangulate vs openssl/libsodium KAT vectors -> S-CLASS" as *u8, acc)
58 // multi-secret store: real, hardened (per-name IV uniqueness) -> PRODUCTION
59 sa_grade(lfd, "multi-secret-store" as *u8, e_multi, 1, 1, 0, 0, "ACL/policy + rotation tracking -> richer parity" as *u8, acc)
60 // tamper-evident audit: real, hardened (catches tamper+delete) -> PRODUCTION
61 sa_grade(lfd, "tamper-evident-audit-log" as *u8, e_audit, 1, 1, 0, 0, "external anchoring (notarize chain head) -> stronger" as *u8, acc)
62 // machine-bound KDF: real, NOT hardened (argon2id memory-hard BLOCKED on codegen defect) -> FUNCTIONAL
63 sa_grade(lfd, "machine-bound-kdf" as *u8, e_vault, 1, 0, 0, 0, "argon2id memory-hard (blocked on codegen defect) -> PRODUCTION" as *u8, acc)
64 // hardware root of trust: NOT built -> ABSENT (the only true answer to physical-access threat)
65 sa_grade(lfd, "tpm-hardware-root" as *u8, 0, 0, 0, 0, 0, "build TPM2/secure-element root -> the physical-access answer" as *u8, acc)
66 _p(" --- HONEST SUMMARY: highest=" as *u8); _p(mat_label(acc[0]))
67 _p(" lowest=" as *u8); _p(mat_label(acc[1])); _p("\n" as *u8)
68 _p(" no S-CLASS/EXCEED in security: nothing is triangulated vs a best-in-class reference yet (parity=0 by design)\n" as *u8)
69 _fp(lfd, "MATAUDIT-SUMMARY domain=security highest=" as *u8); _fp(lfd, mat_label(acc[0]))
70 _fp(lfd, " lowest=" as *u8); _fp(lfd, mat_label(acc[1])); _fp(lfd, " sclass=0 exceed=0\n" as *u8)
71 sys_close(lfd)
72 _p(" Auditor durable output: knowledge/status/maturity_audit.log\n" as *u8)
73 // gate: the audit ran + the three gated caps actually exist (else the auditor's evidence is broken)
74 if e_vault == 1 { if e_multi == 1 { if e_audit == 1 { sys_exit(0); return 0 } } }
75 _p(" AUDIT EVIDENCE INCOMPLETE (a gate did not pass)\n" as *u8)
76 sys_exit(1)
77 return 1
78}